Man convicted for hijacking ex-girlfriend’s MySpace account

After breaking up with her boyfriend of two and a half years, an Illinois woman began to notice obscene messages being posted from her MySpace account. One post included her contact information and a picture of her in a thong. Another read: "Need a blow job? My dad buys them for my boyfriends." She was surprised because although she had shared her password with her ex-boyfriend, she changed it after the breakup.

She called her ex-boyfriend, Steven Kucharski, and demanded that he remove the content or she would go to the police. According to court records, he "started 'giggling and laughing' and told her that she deserved it."

The police investigated. A search warrant to MySpace revealed logs showing that the obscene content had been posted from an IP address belonging to Kucharski's father. Kucharski had helped the woman set up her MySpace account and used an e-mail address that belonged to him. This allowed Kucharski to gain access to the account even after she changed her password.

In February 2012, an Illinois trial court found the evidence sufficient to convict Kucharski of several charges, including "knowingly interrupting" an electronic communications service with intent to harass the victim and "unlawful use of encryption" in the commission of a crime.

Kucharski appealed. On March 29, an Illinois appellate court upheld his conviction for harassment, but it overturned the encryption ruling.

Kucharski argued that the online harassment statute was unconstitutionally vague because it didn't define what it means to "interrupt" an electronic communications service. The appellate court disagreed, holding that it meant "to stop or hinder by breaking in" or "to break the uniformity or continuity of." Accessing his ex-girlfriend's MySpace account without permission clearly fit the definition in the statute, the court ruled.

But the court was persuaded by Kucharski's arguments about the "unlawful use of encryption" charge. This charge was based on Kucharski changing the password on his ex's MySpace account. But the court held that encryption must involve converting data from one format to another. Merely changing the password used to control access to an account didn't qualify.

Under Illinois law, online harassment is generally a misdemeanor. But it can become a felony in certain circumstances, including when the offense is repeated multiple times against the same victim, when the harassment involves death threats, and when an adult harasses a minor. None of those circumstances seems to apply in this case.

A good rule of thumb: don't hijack other peoples' social media accounts. Last month we covered a case in which a court found an employer had violated Pennsylvania law by taking control of a former employee's LinkedIn account.

Joking aside, I certainly understand the harassment charge, and how he was nailed for that and it was perfectly fair, but what kind of prosecutor goes reaching like that for 'unlawful use of encryption'?

If you are going to hijack someone's MySpace or Facebook account make sure you do not use an IP address or email account that can be tied easily to you. Also, do not post anything to the account that can only come from you.

The boyfriend's light bulb most be very dim if he does not know there are such things as logs scattered all over the web.

Joking aside, I certainly understand the harassment charge, and how he was nailed for that and it was perfectly fair, but what kind of prosecutor goes reaching like that for 'unlawful use of encryption'?

My guess is by obtaining/changing the password to gain access after she changed it. A stretch but the law may not allow charging for changing the password explicitly.

wow... the account had HIS email address, so I'm guessing he had the worst attorney in a 12 state area. File this under "If you can't create your own social media account, you don't belong on the interwebs."

Joking aside, I certainly understand the harassment charge, and how he was nailed for that and it was perfectly fair, but what kind of prosecutor goes reaching like that for 'unlawful use of encryption'?

My guess, having worked in a prosecutor's office in college, was the ex continued to be an asshole about it after having been caught, and showed no signs of remorse. So the prosecutor decided to try to add on as many infractions as possible.

In my state, there used to be a law requiring that all car have a trash bag. It was a product of the anti-littering campaigns of the 1970's, and was almost never enforced anymore (I think it has since been repealed). But occasionally I'd see the charge added on to some other infraction by a cop. If you would read the write-up, you would inevitably see clear indications that the person was being a jerk, so the cop went on a "let's see what other violations you're committing" quest.

Note that I'm not saying they made up the charges. Just that they went looking for any other law that the person might have been breaking.

One thing I probably should have mentioned in the article: it took a few years for this case to make its way through the courts. The harassment occurred in 2009. MySpace was definitely in decline at that point, but it wasn't as irrelevant as it is today.

It's not like he hacked into her account. She used his email to sign up for the service and set up the password. If anything he was an authorized user before all this happened. If you did not want to let him have access you should not use your boyfriends email to open your account.

Yeah, OK, the guy is kind of an asshat, but the fact that there even exists a charge such as "unlawful use of encryption" is pretty scary. This was the right result derived from the wrong charge.

How did this not simply fall under, oh I dunno, harassment? Oh, right, because CUMP00T3RZZ and 1NT@RW3BZ!!!!

Quote:

I wonder why this didn't fall under the same anti-hacking laws that Aaron Swartz was charged with.

Don't be ridiculous, you know full well why (he hadn't pissed off anyone with power)

Quote:

It's not like he hacked into her account. She used his email to sign up for the service and set up the password. If anything he was an authorized user before all this happened. If you did not want to let him have access you should not use your boyfriends email to open your account.

Quote:

If she used his email address then it was never her account.

Exactly. As far as "encryption" and "accessing computer systems", he did nothing wrong or illegal. The harassment is a legitimate issue, however, and external to this.

My guess, having worked in a prosecutor's office in college, was the ex continued to be an asshole about it after having been caught, and showed no signs of remorse. So the prosecutor decided to try to add on as many infractions as possible.

Perhaps. But a more general tactic of prosecutors is: throw everything you can at the defendant and see what sticks. The shock and awe of modern prosecution. Build up an insane threat scenario to bully the defendant into a plea bargain.

Not saying that this particular a**hole didn't deserve (some of) it.

Also, wouldn't the better indictment in this case be something in the realm of identiy theft? The encryption bullsh*t had no chance of holding up.

Perhaps. But a more general tactic of prosecutors is: throw everything you can at the defendant and see what sticks. The shock and awe of modern prosecution. Build up an insane threat scenario to bully the defendant into a plea bargain.

I'd agree with respect to federal prosecutions, but state courts don't allow that BS the way federal ones do.

It's not like he hacked into her account. She used his email to sign up for the service and set up the password. If anything he was an authorized user before all this happened. If you did not want to let him have access you should not use your boyfriends email to open your account.

Erm, actually it is her account regardless of what e-mail address she used, just as if she bought something online using her boyfriends credit card (and paid him back/had permission to) it would still be hers.

If your dad helps you buy a house (pays the deposit) and then 2 years later goes round while you're out and helps himself to the TV, is that still theft using your logic? After all it was his money and good name that helped enabled you to buy the house.

>>Not that any of that excuses the ex-boyfriend who clearly can't take a break up like an adult.<<

You make an assumption that she didn't fuck him over in some sleazy underhanded back-stabbing cowardly way, and he was simply trying to deal with the emotional damage that someone he loved betrayed him in that fashion, and perhaps dish a little bit back to her, to see how she liked it.

>>Not that any of that excuses the ex-boyfriend who clearly can't take a break up like an adult.<<

You make an assumption that she didn't fuck him over in some sleazy underhanded back-stabbing cowardly way, and he was simply trying to deal with the emotional damage that someone he loved betrayed him in that fashion, and perhaps dish a little bit back to her, to see how she liked it.

Knife cuts both ways.

They broke up. He hijacked her Myspace account. It doesn't matter that they used his email - it was intended for her use, and she changed the password. Her technological ignorance doesn't make it acceptable, nor do any hypotheticals about what she might have done to him. The boyfriend is immature, and in the wrong. What kind of mindset is "sure, he posted defamatory things about her after they broke up on her Myspace, but that just means they had a really bad breakup and it was her fault," where you give the benefit of the doubt to the one who least deserves it?

I'm with some of you all. If his own personal e-mail address was used, his lawyer should have successfully been able to argue that he was given permission to make changes to the account. The fact she changed the password, but not the email associated with the account afterwards, should have been sufficient fact to argue that point.

While the guy was a jerk about it, that small little point should have been enough to let him legally avoid conviction.

I'm with some of you all. If his own personal e-mail address was used, his lawyer should have successfully been able to argue that he was given permission to make changes to the account. The fact she changed the password, but not the email associated with the account afterwards, should have been sufficient fact to argue that point.

While the guy was a jerk about it, that small little point should have been enough to let him legally avoid conviction.

The fact that she changed the password after the breakup illustrates she did not want him to have permission to access the account. That he did because of her likely technological ignorance does not change her clear intentions.

If your dad helps you buy a house (pays the deposit) and then 2 years later goes round while you're out and helps himself to the TV, is that still theft using your logic? After all it was his money and good name that helped enabled you to buy the house.

More like putting his name on the deed, really. Might not be kosher for him to come in and rearrange the furniture, but hey, unless you have a lease, you're just living in his place.

You make an assumption that she didn't fuck him over in some sleazy underhanded back-stabbing cowardly way, and he was simply trying to deal with the emotional damage that someone he loved betrayed him in that fashion, and perhaps dish a little bit back to her, to see how she liked it.

Ah yes, the "she probably deserved it" asshole defense. Amazing that in this day and age, there are still knuckle draggers who will suggest this as an excuse.

Quote:

I'm with some of you all. If his own personal e-mail address was used, his lawyer should have successfully been able to argue that he was given permission to make changes to the account.

So if you ever need to use a locksmith to let you into your house, that gives them permission to enter your house whenever they want and take your stuff? If you use valet parking, that gives that person permission to grab your car at any other time and go joyriding? Her "crime" was being admittedly computer illiterate, and asking her boyfriend to set up an account for her. That fact alone makes her the owner of the account, not to mention the fact that it was in her name and she was the one to use it. She was apparently unaware that he had used his email address to set up the account, or that he continued to have access to it.

Quote:

Is it a felony if I post on your Facebook wall, if you leave your account logged in at the Apple store? Every week it's someone new...

I'm with some of you all. If his own personal e-mail address was used, his lawyer should have successfully been able to argue that he was given permission to make changes to the account. The fact she changed the password, but not the email associated with the account afterwards, should have been sufficient fact to argue that point.

While the guy was a jerk about it, that small little point should have been enough to let him legally avoid conviction.

The fact that she changed the password after the breakup illustrates she did not want him to have permission to access the account. That he did because of her likely technological ignorance does not change her clear intentions.

In many cases the users are technically ignorant such as not understanding user account information can be easily changed, there are traffic logs kept by many, etc. To the technically literate, such as on Ars, these are obvious but to many not so.

In this case you apparently have two technically illiterates so the issue then becomes one of intent. The ex-boyfriend obvious thought all web traffic is anonymous. I know my posts on Ars could legally (or illegally) be tied to a specific account on at some ISP.

It's not like he hacked into her account. She used his email to sign up for the service and set up the password. If anything he was an authorized user before all this happened. If you did not want to let him have access you should not use your boyfriends email to open your account.

And he wasn't convicted of hacking. He was charged with harassing her and "knowingly interrupting" a computer service that was setup for her use. Which is exactly what he did. This sounds like a rare case of a computer-related prosecution actually being appropriate for the offense rather than being blown out of proportion.

You make an assumption that she didn't fuck him over in some sleazy underhanded back-stabbing cowardly way, and he was simply trying to deal with the emotional damage that someone he loved betrayed him in that fashion, and perhaps dish a little bit back to her, to see how she liked it.

Ah yes, the "she probably deserved it" asshole defense. Amazing that in this day and age, there are still knuckle draggers who will suggest this as an excuse.

Sadly not amazing that in this day and age that there is some white knighting benevolent sexist willing to assume the defendant is the devil simply because a woman cried foul. He trolled her myspace page - in the grand scheme of all the hateful crap people say about their exes, it is the reasonable person, not the "knuckle dragger," who points out that it may have been mutual combat.

It's not like he hacked into her account. She used his email to sign up for the service and set up the password. If anything he was an authorized user before all this happened. If you did not want to let him have access you should not use your boyfriends email to open your account.

And he wasn't convicted of hacking. He was charged with harassing her and "knowingly interrupting" a computer service that was setup for her use. Which is exactly what he did. This sounds like a rare case of a computer-related prosecution actually being appropriate for the offense rather than being blown out of proportion.

Also, he was not charged with a felony but a misdemeanor because the type of harassment did meet the requirements for felony prosecution. The state DA actually appears to understand the difference between being a complete jerk and a serious danger to society. This guy is a completer jerk but is does not appear to be a danger to anyone. The sentence to the jerk says the state of Illinois knows you are a jerk so watch your step because the next time we may not be so nice.

Contrast with Aaron Schwartz who possibly committed a misdemeanor and definitely not a felony in the JSTOR incident and the federal overcharging with state charges here.

Sadly not amazing that in this day and age that there is some white knighting benevolent sexist willing to assume the defendant is the devil simply because a woman cried foul.

LOL. I'm not basing my opinion "simply because a woman cried foul". I'm basing it on rather concrete evidence that A) the ex created the account, B) used his own email address, C) the image posted of her was something that only he had possession of (which she had repeatedly requested that he either destroy or give back to her), D) the changes were traced to the ex's house, E) he only giggled when she confronted him about it, and F) the only defense offered was that the ex's dad suggested that it could have been his younger brother who did it. An aside, clearly the ass doesn't fall very far from the asshole tree, when a dad is more than willing to throw his other son under the bus to defend his dick of a son.

So no, the woman didn't "cry foul". There WAS a foul. This bullshit claims of "white knighting" disgusts me. It's the desperate acts of cowards and assholes, trying to justify the despicable acts of other cowards and assholes under the guise of "the bitch probably deserved it.", probably because none of them have any luck with women, which they blame on them, rather than the fact that they're cowards and assholes. I have seen absolutely NO evidence that this woman deserved what happened to her. If you know of any evidence, by all means, feel free to share with us. Otherwise, shut the fuck up with the assumptions that she deserved it, and anyone coming to her defense is a sexist white knight. The evidence is clearly not on your side.

Timothy B. Lee / Timothy covers tech policy for Ars, with a particular focus on patent and copyright law, privacy, free speech, and open government. His writing has appeared in Slate, Reason, Wired, and the New York Times.